SC-300 - Implement and Manage User Identities (25% of the exam) - Section 1.2

Create, configure, and manage Microsoft Entra users, groups, devices, and licences.

Configure user accounts, group types, dynamic membership rules, custom security attributes, and device join and registration in Microsoft Entra ID. Choose between direct and group-based licence assignment and use bulk operations with PowerShell to manage users at scale.

user accountsgroup types and membershipdynamic membership rulescustom security attributesbulk operations with PowerShelldevice join and registrationlicence assignment

Practice question for this objective

Free sampleImplement and Manage User Identitiesmedium

A data governance team must add a custom CostCentre tag to user accounts and then build dynamic groups whose membership keys off that value. The tag must be a first-class directory attribute that dynamic membership rules can reference, without overloading a built-in attribute. Which Microsoft Entra capability should they use?

APopulate one of the directory extension attributes (extensionAttribute1 to 15) on each user with the CostCentre value, then reference that field in the dynamic membership rule. Correct
BDefine a custom security attribute in an attribute set, assign the CostCentre value to each user, and delegate the attribute set to the governance team.
CCreate an administrative unit named for each cost centre and place the matching users inside it to represent the tag.
DStore the cost centre in the built-in department attribute and reference department in the dynamic membership rule.

Directory extension attributes are custom user attributes that dynamic membership rules can reference, unlike custom security attributes which dynamic rules do not support. Dynamic membership rules can reference built-in and directory extension attributes, but Microsoft Entra does not support custom security attributes in dynamic membership rules. A dedicated extension attribute field provides a custom, first-class tag that dynamic rules can use, without overloading a built-in attribute such as department.

Why A is correct: Directory extension attributes are custom directory fields that dynamic membership rules can reference, so they provide the first-class custom tag that drives dynamic group membership keyed off the CostCentre value.

Why B is wrong: Custom security attributes give governed, delegated tagging, but Microsoft Entra does not support them in dynamic membership group rules, so they cannot drive the dynamic groups the requirement needs.

Why C is wrong: Administrative units scope delegated administration over a set of objects; they are not an attribute on the user and cannot be referenced by dynamic membership rules, so they do not implement a tag.

Why D is wrong: The department field can be used in dynamic rules, but it is a built-in attribute with an existing HR meaning, so overloading it for CostCentre is not a dedicated custom tag and risks conflicts with existing processes.

See more SC-300 practice questions, answers explained.

Exam traps in Implement and Manage User Identities

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-300 bank for this domain.

Create an assigned security group and add each Windows device manually, refreshing membership whenever the device fleet changes.
Why it is wrong: Manual assignment can hold device objects, which makes it look workable, but it needs ongoing administrator effort and will drift out of date, breaking the automatic add and remove requirement.
Create a security group with assigned membership and run a scheduled PowerShell script nightly to add or remove members based on each user's department attribute.
Why it is wrong: A scripted assigned group can mimic the outcome, but it relies on a manual scheduled job rather than the built-in automatic evaluation the requirement specifies.
Assign the Microsoft 365 E3 licence to each Sales user individually in the admin centre, repeating the step whenever a new member joins the group.
Why it is wrong: Per-user assignment works but requires manual action for every joiner and leaver, which is precisely the ongoing effort the requirement seeks to avoid.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.